{
  "node_id": "mitre-attack-ics-t0848-rogue-master",
  "title": "MITRE ATT&CK ICS T0848: Rogue Master (ICS Tactic TA0108 - Initial Access)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-05-25",
  "bluf": "MITRE ATT&CK T0848 (Rogue Master) is an ATT&CK for ICS Initial Access technique. Adversaries may setup a rogue master to leverage control server functions to communicate with outstations. A rogue master can be used to send legitimate control messages to other control system devices, affecting processes in unintended ways. It may also be used to disrupt network communications by capturing and receiving the network traffic meant for the actual master. Impersonating a master may also allow an adversary to avoid detection. Affected asset classes: None. MITRE-documented mitigations include M0813 Software Process and Device Authentication, M0937 Filter Network Traffic, M0930 Network Segmentation, M0807 Network Allowlists, M0802 Communication Authenticity. Operational-technology controls map to NIST SP 800-82 Rev 3 and the IEC/ISA 62443 series.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "mitre_d3fend"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-cybersecurity-framework-2-0",
    "iso-27001-2022",
    "nist-sp-800-53-r5",
    "cis-controls-v8",
    "mitre-attack-framework-v14"
  ],
  "primary_citations_count": 7
}